GHSA-6xch-2vxx-5pvr: Ezsystems/ezplatform EZ Platform Rules To Disable Vulnerability
MODERATEGHSA-6xch-2vxx-5pvr is a MODERATE ez platform rules to disable vulnerability (CWE-670: Always-Incorrect Control Flow Implementation) affecting Ezsystems/ezplatform libraries in the Packagist ecosystem. The issue involves ez platform rules to disable executable access are ignored on platform.sh (ez cloud). Remediation is available by upgrading affected packages to version 2.5.4, 1.13.5.1, 1.7.9.1.
GHSA-6xch-2vxx-5pvr at a Glance
How to Fix GHSA-6xch-2vxx-5pvr
To remediate this vulnerability, upgrade all affected Ezsystems/ezplatform dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade ezsystems/ezplatform to 2.5.4Upgrade ezsystems/ezplatform to 1.13.5.1Upgrade ezsystems/ezplatform to 1.7.9.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for ezsystems/ezplatformHow to Check if You Are Affected
To determine whether your application is affected by GHSA-6xch-2vxx-5pvr, inspect your project dependencies for Ezsystems/ezplatform:
inspect dependencies for ezsystems/ezplatformAnalyze the terminal output to locate any version of Ezsystems/ezplatform in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.5.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-670: Always-Incorrect Control Flow Implementation, where the code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. In Ezsystems/ezplatform, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-6xch-2vxx-5pvr Affected Ezsystems/ezplatform Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
ezsystems/ezplatform
|
Packagist |
≥ 2.5.0
< 2.5.4
|
2.5.4
|
|
ezsystems/ezplatform
|
Packagist |
≥ 1.13.0
< 1.13.5.1
|
1.13.5.1
|
|
ezsystems/ezplatform
|
Packagist |
≥ 1.7.0
< 1.7.9.1
|
1.7.9.1
|
References
Frequently Asked Questions
What is GHSA-6xch-2vxx-5pvr?
Which Ezsystems/ezplatform versions are affected?
What version fixes GHSA-6xch-2vxx-5pvr?
Is ezsystems/ezplatform affected?
What CWE is associated with GHSA-6xch-2vxx-5pvr?
How can I check Packagist dependencies for GHSA-6xch-2vxx-5pvr?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-6xch-2vxx-5pvr",
"modified" : "2024-05-15T21:16:02Z",
"published" : "2024-05-15T21:16:02Z",
"aliases" : [ ],
"summary" : "eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)",
"details" : "The recommended Apache/Nginx virtual host configuration for eZ Platform includes a rewrite rule for blocking access to executable files in the var directory. This rule does not work when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service).\n \nThe consequence of this is that in such a setup, those executable files may be downloadable. They will not be executable, unless you have specifically configured platform.sh to allow that (which you really should not do). The severity of the download access is limited, but it's better if the platform.sh cloud setup works the same way as regular eZ Platform does. All platform.sh setups are affected.\n \nThe fix adds a rule to the .platform.app.yaml configuration file, with the same effect as the rewrite rule already mentioned. After applying the fix, any attempt to access such files will fail with Access Denied. This security update is distributed via Composer as ezsystems/ezplatform 1.7.9.1, and 1.13.5.1, and 2.5.4. This is the commit: https://github.com/ezsystems/ezplatform/commit/773dddc0d8fe4fda34d2153a401eeaa6cc30b1ff",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "ezsystems/ezplatform"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.5.0"
}, {
"fixed" : "2.5.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "ezsystems/ezplatform"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.13.0"
}, {
"fixed" : "1.13.5.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "ezsystems/ezplatform"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.7.0"
}, {
"fixed" : "1.7.9.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/ezsystems/ezplatform/commit/773dddc0d8fe4fda34d2153a401eeaa6cc30b1ff"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform/2019-09-03-1.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/ezsystems/ezplatform"
}, {
"type" : "WEB",
"url" : "https://share.ez.no/community-project/security-advisories/ezsa-2019-006-rules-to-disable-executable-access-are-ignored-on-platform.sh-ez-cloud"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-670" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-05-15T21:16:02Z",
"nvd_published_at" : null
}
}